Dynamic data reporting method, device, equipment and medium across network security domains

Abstract

The present application discloses a method, device, equipment and medium for reporting dynamic data across network security domains, which relates to the field of computer technology, including: receiving all data within a target network domain sent by an application system to obtain intra-domain data; reporting the intra-domain data to an inter-domain data aggregation node, aggregating all intra-domain data at the inter-domain data aggregation node to obtain inter-domain data; reporting the inter-domain data to a top-level data analysis node through the inter-domain data aggregation node, aggregating all inter-domain data at the top-level data analysis node to obtain target data; storing the target data in a target database, and performing data processing and analysis on the target data. The present application establishes a three-layer architecture based on intra-domain data collection nodes, inter-domain data aggregation nodes and top-level data analysis nodes between different network domains to realize dynamic data reporting between different network security domains, effectively integrating data and improving data security.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and medium for reporting dynamic data across network security domains. Background Art

[0002] In recent years, with the development of the Internet, various business processes have shifted from offline to online. In order to facilitate people's online office work, various OA (Office Automation) office systems have emerged one after another. Although these OA office systems facilitate people to handle business, the large amount of valid data and abnormal data generated by the OA office system background are not uniformly monitored and analyzed. At the same time, problems that occur during the operation of the system can only be checked one by one, and these systems cannot be monitored and managed as a whole. The focus of various OA application systems is on interaction with users. Each system has its own unique processing method, and different business processes also have their own data transmission format. There is no unified data recording and analysis function. In addition, data interaction between different network security domains is limited, and data cannot be well summarized.

[0003] The existing monitoring system can only monitor OA applications within the network domain. There are two main implementation methods: one is to collect data through one-to-one data interaction with OA applications through interfaces; the other is to install a detection program on the OA application server, and the main system and the detection program interact one-to-many to collect data. Then analyze the collected data for early warning notification or data display. The first data analysis method is simple to implement, but has poor portability and is not convenient for business expansion. Each OA application needs to develop an interface separately to realize data collection and reporting. The second data analysis uses detection subroutines to collect data, which is more complicated to deploy and difficult to maintain. At the same time, the collected data is relatively large, making it difficult to perform data analysis. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for dynamic data reporting across network security domains, which can realize dynamic data reporting between different network security domains, effectively integrate data and improve data security. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for reporting dynamic data across network security domains, comprising:

[0006] Receive all data in the target network domain sent by the application system to obtain the data in the domain;

[0007] Reporting the intra-domain data to an inter-domain data aggregation node, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain inter-domain data;

[0008] Reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that all the inter-domain data are aggregated at the top-level data analysis node to obtain target data;

[0009] The target data is stored in a target database so as to perform data processing and analysis on the target data.

[0010] Optionally, the receiving all data in the target network domain sent by the application system to obtain the data in the domain includes:

[0011] Through the preset interface of the data collection node within the domain, all the data encapsulated in the target format within the target network domain sent by the application system are received to obtain the data within the domain; the data includes operation status information, abnormal data information, statistical information on the number of sent and received documents, analysis information on the sent and received document data, and the category number corresponding to each information.

[0012] Optionally, before receiving all the data in the target network domain sent by the application system to obtain the data in the domain, the method further includes:

[0013] Determining, in the intra-domain data collection node, whether the data sent by the application system meets a first preset condition;

[0014] If the data sent by the application system does not meet the first preset condition, an error message is returned from the intra-domain data collection node to the corresponding application system;

[0015] If the data sent by the application system meets the first preset condition, the step of receiving all the data in the target network domain sent by the application system is executed.

[0016] Optionally, reporting the intra-domain data to an inter-domain data aggregation node so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain inter-domain data includes:

[0017] storing the intra-domain data in a first database corresponding to the intra-domain data collection node based on the category number;

[0018] When the first scheduled task in the data collection node in the domain starts to be executed, obtaining the current address information of the data collection node in the domain;

[0019] Calculating the access address of the inter-domain data aggregation node based on the current address information and the preset node-to-node hierarchical relationship;

[0020] The intra-domain data obtained from the first database is reported to the inter-domain data aggregation node corresponding to the access address, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain the inter-domain data.

[0021] Optionally, before reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, the method further includes:

[0022] storing the inter-domain data in a second database corresponding to the inter-domain data aggregation node based on the category number;

[0023] Processing the inter-domain data according to a preset data processing rule to obtain the inter-domain data to be uploaded;

[0024] Correspondingly, reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node includes:

[0025] When the second scheduled task in the inter-domain data aggregation node starts to execute, the inter-domain data to be uploaded obtained from the second database is reported to the top-level data analysis node.

[0026] Optionally, after receiving all the data in the target network domain sent by the application system to obtain the data in the domain, the method further includes:

[0027] When the operation status information and the abnormal data information reported in the form of full reporting are received, the historical operation status information and the historical abnormal data information are overwritten with the latest operation status information and the latest abnormal data information;

[0028] When receiving the statistical information on the number of sent and received documents and the statistical information on the data analysis of sent and received documents reported in the form of incremental reporting, adding the statistical information on the number of sent and received documents and the statistical information on the data analysis of sent and received documents to the corresponding database according to the date of the information and the preset information adding rule;

[0029] When each node receives the statistical information on the number of sent and received documents and the analysis information on the data of sent and received documents, it generates corresponding task information;

[0030] Storing the task information in a task table in the database corresponding to each of the nodes;

[0031] When the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are successfully reported, the task information is deleted from the task table.

[0032] Optionally, after storing the target data in a target database so as to perform data processing and analysis on the target data, the method further includes:

[0033] Obtaining data after processing and analysis;

[0034] The processed and analyzed data is stored in a data display table or sent to a target monitoring system at a fixed time.

[0035] In a second aspect, the present application discloses a dynamic data reporting device across network security domains, comprising:

[0036] The intra-domain data acquisition module is used to receive all the data in the target network domain sent by the application system to obtain the intra-domain data;

[0037] An intra-domain data reporting module, used for reporting the intra-domain data to an inter-domain data aggregation node, so that all the intra-domain data can be aggregated at the inter-domain data aggregation node to obtain inter-domain data;

[0038] An inter-domain data reporting module, used for reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that all the inter-domain data can be aggregated at the top-level data analysis node to obtain target data;

[0039] The data processing module is used to store the target data in a target database so as to perform data processing and analysis on the target data.

[0040] In a third aspect, the present application discloses an electronic device, comprising:

[0041] Memory, used to store computer programs;

[0042] The processor is used to execute the computer program to implement the steps of the dynamic data reporting method across network security domains as disclosed above.

[0043] In a fourth aspect, the present application discloses a computer-readable medium for storing a computer program; wherein, when the computer program is executed by a processor, the dynamic data reporting method across network security domains as disclosed above is implemented.

[0044] It can be seen that the present application provides a method for reporting dynamic data across network security domains, including: receiving all the data in the target network domain sent by the application system to obtain the intra-domain data; reporting the intra-domain data to the inter-domain data aggregation node, so that the inter-domain data is aggregated at the inter-domain data aggregation node to obtain the inter-domain data; reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that the inter-domain data is aggregated at the top-level data analysis node to obtain the target data; storing the target data in the target database, so as to perform data processing and analysis on the target data. It can be seen that the present application establishes a three-layer architecture based on the intra-domain data collection node, the inter-domain data aggregation node and the top-level data analysis node between different network domains, realizes dynamic data reporting between different network security domains, facilitates the collection of system data, aggregates, uniformly displays and analyzes the data, effectively integrates the data and improves the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0046] Figure 1 A flow chart of a method for reporting dynamic data across network security domains disclosed in this application;

[0047] Figure 2 This is a diagram of the three-layer reporting channel structure disclosed in this application;

[0048] Figure 3 A flow chart of a specific cross-network security domain dynamic data reporting method disclosed in this application;

[0049] Figure 4 This is a dynamic data reporting flow chart disclosed in this application;

[0050] Figure 5 A flow chart of a dynamic and specific data reporting method across network security domains disclosed in this application;

[0051] Figure 6 A schematic diagram of the structure of a dynamic data reporting device across network security domains provided by this application;

[0052] Figure 7 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] At present, the existing monitoring system can only supervise OA applications within the network domain. There are two main implementation methods: one is to collect data through one-to-one data interaction with OA applications through interfaces; the other is to install a detection program on the OA application server, and the main system and the detection program interact one-to-many to collect data. Then analyze the collected data to perform early warning notifications or data display. The first data analysis method is simple to implement, but has poor portability and is not convenient for business expansion. Each OA application needs to develop an interface separately to realize data collection and reporting. The second data analysis uses a detection subroutine to collect data, which is more complicated to deploy in practice and more difficult to maintain. At the same time, the collected data is more, and it is not easy to perform data analysis. To this end, the present application provides a dynamic data reporting method across network security domains, which can realize dynamic data reporting between different network security domains, effectively integrate data and improve data security.

[0055] The embodiment of the present invention discloses a method for reporting dynamic data across network security domains, see Figure 1 As shown, the method includes:

[0056] Step S11: receiving all data in the target network domain sent by the application system to obtain the data in the domain.

[0057] In this embodiment, all data in the target network domain sent by the application system is received to obtain the data in the domain. Specifically, all data in the target network domain sent by the application system that has been encapsulated in the target format is received through the preset interface of the data acquisition node in the domain to obtain the data in the domain; the data includes operation status information, abnormal data information, statistical information on the number of sent and received documents, analysis information on the sent and received document data, and the category number corresponding to each information. It should be pointed out that the data acquisition node in the domain publishes an interface, through which the OA application encapsulates its own data into a unified format, and reports all the data encapsulated in the target format to the data acquisition node in the network domain.

[0058] It should be pointed out that using a unified data format to report data can effectively integrate data, thereby enabling data comparison between different OA applications.

[0059] It is understandable that dynamic data reporting between different network security domains can be achieved by building a three-level architecture reporting channel between different network domains and defining a unified system monitoring category specification. The three-level architecture is: intra-domain data collection node, inter-domain data aggregation node, and top-level data analysis node. Figure 2 As shown in the figure, the top-level data analysis node contains multiple inter-domain data summary nodes, and each inter-domain data summary node contains multiple intra-domain data collection nodes. The intra-domain data collection node is responsible for providing a data collection interface to the third-party OA application system to receive user data and abnormal data generated by the third party. There is at least one intra-domain data collection node in a security domain.

[0060] Step S12: reporting the intra-domain data to the inter-domain data aggregation node, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain inter-domain data.

[0061] In this embodiment, after receiving all the data in the target network domain sent by the application system to obtain the data in the domain, the data in the domain is reported to the inter-domain data summary node, so that all the data in the domain are summarized at the inter-domain data summary node to obtain the inter-domain data. It can be understood that the inter-domain data summary node is responsible for receiving the data reported by the intra-domain collection nodes in the entire security domain, and according to the actual situation, performs simple processing and analysis on the data to reduce redundant data.

[0062] Step S13: reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that all the inter-domain data are aggregated at the top-level data analysis node to obtain target data.

[0063] In this embodiment, the intra-domain data is reported to the inter-domain data summary node, and after the inter-domain data summary node summarizes all the intra-domain data to obtain the inter-domain data, the inter-domain data is reported to the top-level data analysis node through the inter-domain data summary node, so that the top-level data analysis node summarizes all the inter-domain data to obtain the target data. It can be understood that the top-level data analysis node is responsible for summarizing the data of all network domains, displaying them uniformly, or passing the data to a dedicated monitoring platform.

[0064] Step S14: storing the target data in a target database so as to perform data processing and analysis on the target data.

[0065] In this embodiment, after the top-level data analysis node aggregates all the inter-domain data and obtains the target data, the target data is stored in the target database so as to perform data processing and analysis on the target data. It can be understood that the target database is a database corresponding to the top-level data analysis node. After receiving the data reported by the subordinate, the top-level data analysis node stores the original data in the target database, processes and analyzes the data, stores the processed and analyzed data in the display table, or sends it to a third-party monitoring system at regular intervals.

[0066] It is understandable that the design of a three-tier architecture and the use of a bottom-up hierarchical reporting method can provide the least pressure on OA applications and the safest data protection, and conduct a comprehensive data reporting and summary of the working status, load conditions, business volume, faults and warnings of each OA application system. Compared with the existing technology, the three-tier architecture provides a unified data format, which is convenient for data integration and analysis. It can provide relevant data according to different OA applications, conduct data analysis and comparison between different applications, establish a cross-domain security channel between different domains, and summarize the data. At the same time, the corresponding data interface is provided to the OA application, and the OA application itself provides relevant data as needed, which can guarantee the security of OA system data to the greatest extent, solve the data transmission between different network security domains, and the independent dynamic transmission channel will not affect the normal operation of the OA application, which is convenient for systematic analysis of data and convenient for operation and maintenance managers to deal with abnormal problems in the system in a timely manner.

[0067] It can be seen that the present application provides a method for reporting dynamic data across network security domains, including: receiving all the data in the target network domain sent by the application system to obtain the intra-domain data; reporting the intra-domain data to the inter-domain data aggregation node, so that the inter-domain data is aggregated at the inter-domain data aggregation node to obtain the inter-domain data; reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that the inter-domain data is aggregated at the top-level data analysis node to obtain the target data; storing the target data in the target database, so as to perform data processing and analysis on the target data. It can be seen that the present application establishes a three-layer architecture based on the intra-domain data collection node, the inter-domain data aggregation node and the top-level data analysis node between different network domains, realizes dynamic data reporting between different network security domains, facilitates the collection of system data, aggregates, uniformly displays and analyzes the data, effectively integrates the data and improves the security of the data.

[0068] See also Figure 3 As shown, the embodiment of the present invention discloses a method for reporting dynamic data across network security domains. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0069] Step S21: determining in the intra-domain data collection node whether the data sent by the application system meets a first preset condition.

[0070] In this embodiment, the intra-domain data collection node determines whether the data sent by the application system meets the first preset condition. Figure 4 As shown, when the OA application encapsulates the respective data into data in a unified format and reports it to the data collection node in the network domain through the interface published by the data collection node in the domain, it is necessary to judge whether the data sent by the application system meets the first preset condition in the data collection node in the domain. For example, to judge whether the data is valid, if the data sent by the application system does not meet the first preset condition, that is, the data is unavailable, an error message is returned from the data collection node in the domain to the corresponding application system, and no processing is performed on the reported data.

[0071] Step S22: If the data sent by the application system meets the first preset condition, all data in the target network domain sent by the application system is received to obtain the data in the domain.

[0072] In this embodiment, after determining whether the data sent by the application system meets the first preset condition in the intra-domain data collection node, if the data sent by the application system meets the first preset condition, that is, the data is valid, all the data in the target network domain sent by the application system is received to obtain intra-domain data. And for the data that meets the requirements, the data collection node will store the data in the corresponding first database according to the data type, and wait for the scheduled task to be executed.

[0073] Step S23: reporting the intra-domain data to the inter-domain data aggregation node, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain inter-domain data.

[0074] In this embodiment, if the data sent by the application system meets the first preset condition, all the data in the target network domain sent by the application system is received, and after the data in the domain is obtained, the data in the domain is reported to the inter-domain data summary node, so that all the data in the domain are summarized in the inter-domain data summary node to obtain the inter-domain data. It can be understood that for data that meets the requirements, the data in the domain is stored in the first database corresponding to the data collection node in the domain based on the category number; when the first scheduled task in the data collection node in the domain starts to execute, the current address information of the data collection node in the domain is obtained; the access address of the inter-domain data summary node is calculated based on the current address information and the pre-set node-to-node relationship; the data in the domain obtained from the first database is reported to the inter-domain data summary node corresponding to the access address, so that all the data in the domain are summarized in the inter-domain data summary node to obtain the inter-domain data. It should be pointed out that when the scheduled task starts to execute, the routing calculation is first performed to obtain the access address and node information of the upper node, and then the data is reported to the inter-domain data summary node.

[0075] Specifically, when establishing a three-tier architecture channel, it is necessary to configure the superior-subordinate relationship between each node, and use the CC.BB.AA format to determine the superior-subordinate relationship between nodes. The top-level data analysis node can be set to AA, then its lower-level inter-domain data aggregation node can be set to BB.AA, and the lowest-level intra-domain data collection node can be set to CC.BB.AA. This design can provide different reporting interval configurations for different reported data, and can configure the reporting interval according to the actual situation on site. At the same time, it provides the configuration of scheduled tasks, and the generated data is reported uniformly to prevent data omissions.

[0076] Step S24: storing the inter-domain data in a second database corresponding to the inter-domain data aggregation node based on the category number.

[0077] In this embodiment, after the inter-domain data aggregation node aggregates all the intra-domain data and obtains the inter-domain data, the inter-domain data is stored in the second database corresponding to the inter-domain data aggregation node based on the category number. It can be understood that the inter-domain data aggregation node is responsible for receiving the data reported by the lower-level nodes and performing a simple analysis and aggregation on the data while storing it in the second database, waiting for the scheduled task to be executed.

[0078] Step S25: Process the inter-domain data according to preset data processing rules to obtain inter-domain data to be uploaded.

[0079] In this embodiment, after the inter-domain data is stored in the second database corresponding to the inter-domain data aggregation node based on the category number, the inter-domain data is processed according to the preset data processing rule to obtain the inter-domain data to be uploaded. It can be understood that after the inter-domain data is stored in the second database, the inter-domain data can be simply analyzed and summarized. For example, when the amount of inter-domain data is too large, the data can be deduplicated, calculated, etc. to obtain the inter-domain data to be uploaded.

[0080] Step S26: When the second scheduled task in the inter-domain data aggregation node starts to execute, the inter-domain data to be uploaded obtained from the second database is reported to the top-level data analysis node, so that all the inter-domain data to be uploaded are aggregated at the top-level data analysis node to obtain the target data.

[0081] In this embodiment, when the second scheduled task in the inter-domain data aggregation node starts to execute, the inter-domain data to be uploaded obtained from the second database is reported to the top-level data analysis node, so that the top-level data analysis node aggregates all the inter-domain data to be uploaded to obtain the target data. It can be understood that when there is only one top-level data analysis node in the entire architecture, the inter-domain data to be uploaded obtained from the second database is directly reported to the top-level data analysis node; if there are multiple top-level data analysis nodes in the entire architecture, routing calculation is performed to obtain the access address and node information of the target top-level data analysis node, and then the data is reported to the target top-level data analysis node.

[0082] Step S27: storing the target data in a target database so as to perform data processing and analysis on the target data.

[0083] For the specific content of the above step S27, reference may be made to the corresponding content disclosed in the above embodiments, which will not be repeated here.

[0084] It can be seen that the embodiment of the present application determines whether the data sent by the application system meets the first preset condition in the intra-domain data collection node; if the data sent by the application system meets the first preset condition, then all the data in the target network domain sent by the application system is received to obtain the intra-domain data; the intra-domain data is reported to the inter-domain data aggregation node, so that all the intra-domain data is aggregated at the inter-domain data aggregation node to obtain the inter-domain data; based on the category number, the inter-domain data is stored in the second database corresponding to the inter-domain data aggregation node; the inter-domain data is processed according to the preset data processing rules to obtain the inter-domain data to be uploaded; when the second scheduled task in the inter-domain data aggregation node starts to execute, the inter-domain data to be uploaded obtained from the second database is reported to the top-level data analysis node, so that all the inter-domain data to be uploaded is aggregated at the top-level data analysis node to obtain the target data; the target data is stored in the target database, so as to perform data processing and analysis on the target data, which effectively integrates the data and improves the data security.

[0085] See also Figure 5 As shown, the embodiment of the present invention discloses a method for reporting dynamic data across network security domains. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0086] Step S31: receiving all data in the target network domain sent by the application system to obtain the data in the domain.

[0087] In this embodiment, all data in the target network domain sent by the application system is received to obtain the data in the domain. It can be understood that the data categories reported by the application system monitoring include: operation status information (i.e., OA application system operation status information reporting), abnormal data information (i.e., OA application business abnormal data reporting), sent and received document quantity statistics information (i.e., OA application sent and received document quantity statistics reporting), sent and received document data analysis information (i.e., OA application document data analysis reporting), and the category (type) number corresponding to each information. The specific correspondence between the data category number and the data classification index is shown in Table 1 below:

[0088] Table 1

[0089] Category type number Representative meaning 0 OA application system operation status information reporting 1 OA application business abnormal data reporting 2 OA application sent and received document statistics report 3 OA application publication data analysis and reporting

[0090] The category (type) number corresponding to each data category has been determined before the data is uploaded. It is understandable that the system operation status report is responsible for summarizing and displaying the CPU (central processing unit) indicators, memory indicators, and disk indicators of each OA application system; the abnormal data report is responsible for monitoring various abnormal data generated by the application, such as failed data, timeout data, etc.; the number of sent and received documents is responsible for summarizing the number of business interactions of each OA application as a whole; the data analysis report of sent and received documents is responsible for summarizing the data that each OA system needs to display in particular, such as status statistics, urgency statistics, etc. It is understandable that the working status, load conditions, business volume, faults and warnings of each OA application system are uniformly monitored, and the monitoring data is submitted to the superior node system. A special transmission channel that only allows upward transmission of messages is opened between different network domains, and a hierarchical verification is performed through a three-layer architecture to confirm the reliability and validity of the data. According to a unified interface, the data between different OA applications is summarized to form a unified data format.

[0091] Step S32: reporting the intra-domain data to the inter-domain data aggregation node, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain inter-domain data.

[0092] Step S33: reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that all the inter-domain data are aggregated at the top-level data analysis node to obtain target data.

[0093] Step S34: when the operation status information and the abnormal data information reported in the form of full reporting are received, the historical information is overwritten.

[0094] In this embodiment, when the operating status information and the abnormal data information reported in the form of full reporting are received, the historical information is overwritten. It can be understood that when the operating status information and the abnormal data information reported in the form of full reporting are received, the latest operating status information and the latest abnormal data information are used to overwrite the historical operating status information and the historical abnormal data information, that is, for the OA application system operating status information and the OA application business abnormal data system, the full reporting form is adopted, and each time the data is received, the previous data will be directly overwritten according to the reporting node. It should be pointed out that no matter any node in the intra-domain data collection node, the inter-domain data aggregation node, or the top-level data analysis node receives the operating status information and the abnormal data information reported in the form of full reporting, the latest operating status information and the latest abnormal data information are used to overwrite the historical operating status information and the historical abnormal data information.

[0095] Step S35: when receiving the sent / received document quantity statistical information and the sent / received document data analysis information reported in the form of incremental reporting, adding corresponding information.

[0096] In this embodiment, when the statistical information on the number of sent and received documents and the data analysis information on the sent and received documents are received in the form of incremental reporting, the corresponding information is added. It can be understood that when the statistical information on the number of sent and received documents and the data analysis information on the sent and received documents are received in the form of incremental reporting, the statistical information on the number of sent and received documents and the data analysis information on the sent and received documents are added to the corresponding database according to the date of the information and in accordance with the preset information adding rules. That is, for the statistical information on the number of sent and received documents of OA applications and the data analysis of OA application documents, the form of incremental reporting is adopted, and data is added according to different dates after each data is received.

[0097] Step S36: When each node receives the statistical information on the number of sent and received documents and the data analysis information on sent and received documents, it generates corresponding task information and stores the task information in a task table in the database corresponding to each node.

[0098] In this embodiment, when each node receives the statistical information on the number of sent and received documents and the analysis information on the data of sent and received documents, it generates corresponding task information and stores the task information in the task table in the database corresponding to each node. It is understandable that each time any node in the system receives the statistical information on the number of sent and received documents and the analysis information on the data of sent and received documents, it generates a task and writes it into the pre-set task table in the database corresponding to the node to prevent the failure of incremental data reporting.

[0099] Step S37: After the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are successfully reported, the task information is deleted from the task table.

[0100] In this embodiment, after the task information is stored in the task table in the database corresponding to each node, a data reporting operation is performed, and when the statistical information on the number of sent and received documents and the data analysis information on the sent and received documents are successfully reported, the task information is deleted from the task table. When the statistical information on the number of sent and received documents and the data analysis information on the sent and received documents are not successfully reported, this piece of task information still exists in the task table, that is, it can be determined whether the incremental data upload fails based on the task information in the task table.

[0101] Step S38: storing the target data in a target database so as to perform data processing and analysis on the target data.

[0102] In this embodiment, the target data is stored in a target database so that after data processing and analysis of the target data, the processed and analyzed data is obtained, and the processed and analyzed data is stored in a data display table or sent to a target monitoring system at a fixed time.

[0103] For the specific contents of the above steps S32 and S33, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be repeated here.

[0104] It can be seen that the embodiment of the present application receives all the data in the target network domain sent by the application system to obtain the intra-domain data; reports the intra-domain data to the inter-domain data aggregation node, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain the inter-domain data; reports the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, so that all the inter-domain data are aggregated at the top-level data analysis node to obtain the target data; when the operating status information and the abnormal data information reported in the form of full reporting are received, the historical information is overwritten; when the operating status information and the abnormal data information reported in the form of incremental reporting are received, the historical information is overwritten. When the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are reported, the corresponding information is added; when each node receives the statistical information on the number of sent and received documents and the analysis information on the sent and received document data, the corresponding task information is generated, and the task information is stored in the task table in the database corresponding to each node; when the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are successfully reported, the task information is deleted from the task table; the target data is stored in the target database so as to perform data processing and analysis on the target data, thereby effectively integrating the data and improving the security of the data.

[0105] See also Figure 6 As shown, the embodiment of the present application also discloses a dynamic data reporting device across network security domains, including:

[0106] The intra-domain data acquisition module 11 is used to receive all the data in the target network domain sent by the application system to obtain the intra-domain data;

[0107] The intra-domain data reporting module 12 is used to report the intra-domain data to the inter-domain data summary node, so that all the intra-domain data can be summarized at the inter-domain data summary node to obtain inter-domain data;

[0108] The inter-domain data reporting module 13 is used to report the inter-domain data to the top-level data analysis node through the inter-domain data summary node, so that all the inter-domain data can be summarized at the top-level data analysis node to obtain target data;

[0109] The data processing module 14 is used to store the target data in a target database so as to perform data processing and analysis on the target data.

[0110] It can be seen that the present application includes: receiving all the data in the target network domain sent by the application system to obtain the data in the domain; reporting the data in the domain to the inter-domain data summary node, so that the inter-domain data is summarized at the inter-domain data summary node to obtain the inter-domain data; reporting the inter-domain data to the top-level data analysis node through the inter-domain data summary node, so that the inter-domain data is summarized at the top-level data analysis node to obtain the target data; storing the target data in the target database, so as to perform data processing and analysis on the target data. It can be seen that the present application establishes a three-layer architecture based on the intra-domain data collection node, the inter-domain data summary node and the top-level data analysis node between different network domains, realizes dynamic data reporting between different network security domains, facilitates the collection of system data, summarizes, uniformly displays and analyzes the data, effectively integrates the data and improves the security of the data.

[0111] In some specific embodiments, the intra-domain data acquisition module 11 specifically includes:

[0112] An intra-domain data determination unit, configured to determine in the intra-domain data collection node whether the data sent by the application system meets a first preset condition;

[0113] an error information returning unit, configured to return error information from the intra-domain data collection node to the corresponding application system if the data sent by the application system does not meet the first preset condition;

[0114] The intra-domain data acquisition unit is used to receive all the data encapsulated in the target format in the target network domain sent by the application system through the preset interface of the intra-domain data acquisition node if the data sent by the application system meets the first preset condition, so as to obtain the intra-domain data; the data includes operation status information, abnormal data information, statistical information on the number of sent and received documents, analysis information on the sent and received document data, and the category number corresponding to each information.

[0115] In some specific embodiments, the intra-domain data reporting module 12 specifically includes:

[0116] An intra-domain data storage unit, configured to store the intra-domain data in a first database corresponding to the intra-domain data collection node based on the category number;

[0117] A current address information acquisition unit, configured to acquire the current address information of the data acquisition node in the domain when the first scheduled task in the data acquisition node in the domain starts to be executed;

[0118] An access address calculation unit, used to calculate the access address of the inter-domain data aggregation node based on the current address information and a preset upper-lower relationship between nodes;

[0119] The inter-domain data acquisition unit is used to report the intra-domain data acquired from the first database to the inter-domain data aggregation node corresponding to the access address, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain the inter-domain data.

[0120] In some specific embodiments, the inter-domain data reporting module 13 specifically includes:

[0121] An inter-domain data storage unit, configured to store the inter-domain data in a second database corresponding to the inter-domain data aggregation node based on the category number;

[0122] The inter-domain data acquisition unit to be uploaded is used to process the inter-domain data according to a preset data processing rule to obtain the inter-domain data to be uploaded;

[0123] a target data acquisition unit, configured to report the inter-domain data to be uploaded obtained from the second database to the top-level data analysis node when the second scheduled task in the inter-domain data aggregation node starts to be executed, so as to aggregate all the inter-domain data at the top-level data analysis node to obtain target data;

[0124] A data overwriting unit, configured to overwrite historical running status information and historical abnormal data information with the latest running status information and the latest abnormal data information when receiving the running status information and the abnormal data information reported in the form of full reporting;

[0125] A data adding unit, configured to add the statistical information on the number of sent and received documents and the analysis information on the data of sent and received documents reported in an incremental reporting form to a corresponding database according to the date of the information and in accordance with a preset information adding rule;

[0126] A task information generating unit, configured to generate corresponding task information when each node receives the sent and received document quantity statistical information and the sent and received document data analysis information;

[0127] A task information storage unit, used to store the task information in a task table in the database corresponding to each of the nodes;

[0128] The task information deleting unit is used to delete the task information from the task table after the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are successfully reported.

[0129] In some specific embodiments, the data processing module 14 specifically includes:

[0130] A target data storage unit, used to store the target data in a target database so as to perform data processing and analysis on the target data;

[0131] A post-processing and analysis data acquisition unit, used to acquire the post-processing and analysis data;

[0132] The processed and analyzed data sending unit is used to store the processed and analyzed data in a data display table or send it to a target monitoring system at a fixed time.

[0133] Furthermore, an embodiment of the present application also provides an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0134] Figure 7 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the dynamic data reporting method across network security domains disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0135] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0136] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0137] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the dynamic data reporting method across network security domains performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0138] Furthermore, an embodiment of the present application also discloses a medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the dynamic data reporting method across network security domains disclosed in any of the aforementioned embodiments are implemented.

[0139] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0140] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0141] The above is a detailed introduction to a dynamic data reporting method, device, equipment and medium across network security domains provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for reporting dynamic data across network security domains, characterized in that: include: Receive all the data in the target network domain sent by the application system through the data collection node in the domain to obtain the data in the domain; The intra-domain data is reported to the inter-domain data aggregation node through the intra-domain data acquisition node, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain inter-domain data, and the inter-domain data aggregation node includes a plurality of the intra-domain data acquisition nodes; The inter-domain data is reported to the top-level data analysis node through the inter-domain data summary node, so that all the inter-domain data are summarized at the top-level data analysis node to obtain target data, and the top-level data analysis node includes multiple inter-domain data summary nodes; Storing the target data in a target database so as to perform data processing and analysis on the target data; The receiving of all data in the target network domain sent by the application system to obtain the data in the domain includes: receiving all data in the target network domain sent by the application system and encapsulated into the target format through a preset interface of the data collection node in the domain to obtain the data in the domain; the data includes operation status information, abnormal data information, sent and received document quantity statistics information, sent and received document data analysis information and category numbers corresponding to each information; wherein the target format is a unified format; When the operation status information and the abnormal data information reported in the form of full reporting are received, the historical operation status information and the historical abnormal data information are overwritten with the latest operation status information and the latest abnormal data information; When receiving the statistical information on the number of sent and received documents and the statistical information on the data analysis of sent and received documents reported in the form of incremental reporting, adding the statistical information on the number of sent and received documents and the statistical information on the data analysis of sent and received documents to the corresponding database according to the date of the information and the preset information adding rule; When each node receives the statistical information on the number of sent and received documents and the analysis information on the data of sent and received documents, it generates corresponding task information; Storing the task information in a task table in the database corresponding to each of the nodes; When the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are successfully reported, the task information is deleted from the task table.

2. The method for reporting dynamic data across network security domains according to claim 1, characterized in that: Before receiving all the data in the target network domain sent by the application system to obtain the data in the domain, the method further includes: Determining, in the intra-domain data collection node, whether the data sent by the application system meets a first preset condition; If the data sent by the application system does not meet the first preset condition, an error message is returned from the intra-domain data collection node to the corresponding application system; If the data sent by the application system meets the first preset condition, the step of receiving all the data in the target network domain sent by the application system is executed.

3. The method for reporting dynamic data across network security domains according to claim 1, characterized in that: The step of reporting the intra-domain data to the inter-domain data aggregation node so as to aggregate all the intra-domain data at the inter-domain data aggregation node to obtain inter-domain data includes: storing the intra-domain data in a first database corresponding to the intra-domain data collection node based on the category number; When the first scheduled task in the data collection node in the domain starts to be executed, obtaining the current address information of the data collection node in the domain; Calculating the access address of the inter-domain data aggregation node based on the current address information and the preset node-to-node hierarchical relationship; The intra-domain data obtained from the first database is reported to the inter-domain data aggregation node corresponding to the access address, so that all the intra-domain data are aggregated at the inter-domain data aggregation node to obtain the inter-domain data.

4. The method for reporting dynamic data across network security domains according to claim 1, characterized in that: Before reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node, the method further includes: storing the inter-domain data in a second database corresponding to the inter-domain data aggregation node based on the category number; Processing the inter-domain data according to a preset data processing rule to obtain the inter-domain data to be uploaded; Correspondingly, reporting the inter-domain data to the top-level data analysis node through the inter-domain data aggregation node includes: When the second scheduled task in the inter-domain data aggregation node starts to execute, the inter-domain data to be uploaded obtained from the second database is reported to the top-level data analysis node.

5. The method for reporting dynamic data across network security domains according to any one of claims 1 to 4, characterized in that: After storing the target data in a target database so as to perform data processing and analysis on the target data, the method further includes: Obtaining data after processing and analysis; The processed and analyzed data is stored in a data display table or sent to a target monitoring system at a fixed time.

6. A dynamic data reporting device across network security domains, characterized in that: include: The intra-domain data acquisition module is used to receive all the data in the target network domain sent by the application system through the intra-domain data acquisition node to obtain the intra-domain data; An intra-domain data reporting module, used for reporting the intra-domain data to an inter-domain data aggregation node through the intra-domain data acquisition node, so as to aggregate all the intra-domain data at the inter-domain data aggregation node to obtain inter-domain data, wherein the inter-domain data aggregation node includes a plurality of the intra-domain data acquisition nodes; An inter-domain data reporting module, used for reporting the inter-domain data to a top-level data analysis node through the inter-domain data summary node, so that all the inter-domain data can be summarized at the top-level data analysis node to obtain target data, wherein the top-level data analysis node includes a plurality of the inter-domain data summary nodes; A data processing module, used for storing the target data in a target database so as to perform data processing and analysis on the target data; The receiving of all data in the target network domain sent by the application system to obtain the data in the domain includes: receiving all data in the target network domain sent by the application system and encapsulated into the target format through a preset interface of the data collection node in the domain to obtain the data in the domain; the data includes operation status information, abnormal data information, sent and received document quantity statistics information, sent and received document data analysis information and category numbers corresponding to each information; wherein the target format is a unified format; A data overwriting unit, configured to overwrite historical running status information and historical abnormal data information with the latest running status information and the latest abnormal data information when receiving the running status information and the abnormal data information reported in the form of full reporting; A data adding unit, configured to add the statistical information on the number of sent and received documents and the analysis information on the data of sent and received documents reported in an incremental reporting form to a corresponding database according to the date of the information and in accordance with a preset information adding rule; A task information generating unit, configured to generate corresponding task information when each node receives the sent and received document quantity statistical information and the sent and received document data analysis information; A task information storage unit, used to store the task information in a task table in the database corresponding to each of the nodes; The task information deleting unit is used to delete the task information from the task table after the statistical information on the number of sent and received documents and the analysis information on the sent and received document data are successfully reported.

7. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the method for dynamic data reporting across network security domains as described in any one of claims 1 to 5.

8. A computer-readable medium, characterized in that Used to store computer programs; wherein, when the computer program is executed by a processor, the dynamic data reporting method across network security domains as described in any one of claims 1 to 5 is implemented.

Images